Win.Trojan.Wazzu-26 Office (OLE) malware analysis — malicious · 9c69121855a29153

MALICIOUS

Office (OLE)

6.0 KB First seen: 2012-06-14

MD5: 9ab8713883ce247094ad460ff8f46f89 SHA-1: cfd9fb7ef1b34a06c41923b696145bb086a29779 SHA-256: 9c69121855a29153e0ad6dc1d8b4b9138c5e4ff29a045dd63a1b1b5a02eb7269

102 Risk Score

Malware Insights

Win.Trojan.Wazzu-26 · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic

The file exhibits legacy WordBasic macro virus markers and is detected by ClamAV as Win.Trojan.Wazzu-26. The embedded document body contains text that explicitly refers to it as a 'RSN MACRO VIRUS Goat file' and includes macro-related function names like 'AutoOpen', indicating it likely executes malicious code upon opening.

Heuristics 3

ClamAV: Win.Trojan.Wazzu-26 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Wazzu-26
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE

The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 297 bytes

Filename	Kind	Source	Size
`wordbasic_macros.txt`	wordbasic-macro	analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source)	297 bytes
SHA-256: `6768fc7b5ee13c35ae502fa6751af18cd5626e463938a65a606362644bc80c25`
Preview script First 1,000 lines of the extracted script MAIN , - * MinSize @cmd0056 = "Acid_Burn" TagNummer = @cmd80f2 @cmd80f7 TagNummer 5 , 10 , 15 , 20 , 25 , 30 @cmd0054 = "Assassins" F$ = @cmd8025 = ":AutoOpen" G$ = "Global:AutoOpen" M$ = @cmd80af @cmd8009 @cmd818e @cmd80b8 0 , 10 M$ = "NORMAL.DOT" @cmd80c2 G$ , F$ @cmd0054 = 1 @cmd80c2 F$ , G$ =

SHA-256: 6768fc7b5ee13c35ae502fa6751af18cd5626e463938a65a606362644bc80c25

Preview script

First 1,000 lines of the extracted script

MAIN
, - * MinSize
@cmd0056
= "Acid_Burn"
TagNummer = @cmd80f2 @cmd80f7
TagNummer
5 , 10 , 15 , 20 , 25 , 30
@cmd0054 = "Assassins"
F$ = @cmd8025 = ":AutoOpen"
G$ = "Global:AutoOpen"
M$ = @cmd80af @cmd8009 @cmd818e @cmd80b8 0 , 10
M$ = "NORMAL.DOT"
@cmd80c2 G$ , F$
@cmd0054 = 1
@cmd80c2 F$ , G$
=

Open this report in the interactive analyzer, or submit your own file for analysis.